Deployment

Documentation home Compatibility Security Validation

Prerequisites and execution phase

ConfigMgr Task Sequence pattern: set variables, run the script and save its result, clear variables on success and failure, then report the saved result

Open the full-size Task Sequence pattern. The equivalent sequence is:

Complete domain join
Restart into the installed Windows operating system
Set hidden ADGroupUserName and ADGroupPassword
Run packaged Add-ComputerToADGroup.ps1 and save its result
Clear ADGroupUserName and ADGroupPassword on success and failure
Report or propagate the saved script result

The restart may already be part of Windows setup, but it must have completed after domain join before this script runs.

Run PowerShell Script step

Keep the Scripts directory in the package source, distribute the package, and configure:

Package: package containing Scripts\Add-ComputerToADGroup.ps1
Script name: Scripts\Add-ComputerToADGroup.ps1
Run as another account: Disabled
PowerShell parameter logging: Disabled
Success code: 0

Use your organization’s approved execution policy. AllSigned requires you to sign the script with a trusted certificate; the supplied script is not signed. Do not put credentials in the parameters field.

For the native step’s parameter logging, leave OSDLogPowerShellParameters unset or set it to False; do not enable it. This is a ConfigMgr logging control, not a credential variable read by this script. See Microsoft’s Run PowerShell Script step.

Size the step timeout for your environment. The default three passes can include two 300-second sleeps, plus discovery, connection, and multiple LDAP operations for each DC/group; TimeoutSeconds is not an overall script deadline. A fixed 20-minute timeout is not guaranteed to cover every environment.

Variables

Exact custom variable Value Setting
ADGroupUserName Dedicated account, for example CONTOSO\svc-configmgr-adgroups Do not display this value
ADGroupPassword That account’s password, entered through approved Task Sequence administration Do not display this value

The script reads only these custom credential variables, never reserved ConfigMgr credentials. _SMSTSLogPath is read only to select the log directory.

Parameters

Use group sAMAccountName values, not distinguished names or display names.

-GroupName 'Workstation-Certificate-AutoEnroll'

For multiple groups, the Run PowerShell Script step’s parameters field accepts a PowerShell array:

-GroupName 'Group-A','Group-B' -RetryCount 3 -RetryDelaySeconds 300 -TimeoutSeconds 30
Parameter Default Contract
GroupName Required One or more group sAMAccountName values; whitespace is trimmed and case-insensitive duplicates are removed, preserving input order
RetryCount 3 Total retry passes, including the first attempt; range 1-10
RetryDelaySeconds 300 Delay between passes with unresolved groups; range 0-3600
TimeoutSeconds 30 LDAP connection/operation timeout per DC, not total runtime; range 5-300
AuthenticationMode Kerberos Kerberos or explicit Negotiate; Negotiate requires AllowNtlmV2
DirectoryTransport LDAPS LDAPS on TCP 636 or explicit SignedLdap on TCP 389 with signing and sealing
AllowNtlmV2 Not set Explicit opt-in required for Negotiate; local LmCompatibilityLevel must be 3, 4, or 5. Does not force or attest an NTLM version and does not change Kerberos mode

Keep compatibility examples separate from the default deployment; see compatibility and security before changing authentication or transport.

Credential lifecycle

Create both hidden credential variables immediately before the script step and clear them immediately afterward using native Task Sequence steps. The script disposes its own secure-password buffer when finished, but does not clear the Task Sequence variables for you. Neither action guarantees erasure of all managed credential copies.

Do not rely on a cleanup step that is skipped when the script fails. Configure a failure-handling path that preserves the Run PowerShell Script result before later steps overwrite it, clears both variables, and then applies the deployment’s failure policy. If using Continue on error to reach cleanup, do not treat that as permission to ignore a failed membership operation. Verify this path in a live Task Sequence.

Results and logs